Active campaign | Tier 1 source: Zscaler ThreatLabz | Middle East government targets
Zscaler ThreatLabz published research this week documenting a sustained East Asia APT campaign against Middle East government organizations. The actor delivers three purpose-built malware families through ISO container files and abuses a signed ASUS binary to sideload the initial stager. All command-and-control traffic flows through the Telegram Bot API, a design choice that lets the actor hide in the same cloud traffic logs as legitimate Telegram usage by employees.
Three malware families, one campaign
Zscaler named the three families TELESHIM, MIXEDKEY, and BINDCLOAK. Each plays a distinct role in the infection chain.
TELESHIM is the primary implant and communicates directly with the Telegram Bot API. It receives task instructions from threat-actor-controlled bots, executes commands on the victim host, and routes output back through the same channel. TELESHIM's bot polling mimics normal application behavior, making it difficult to distinguish from a chat client in aggregate traffic logs.
MIXEDKEY is a cryptographic utility component that Zscaler found applying control flow flattening across its code paths. Control flow flattening restructures conditional branches into a dispatcher loop, making static analysis substantially harder and causing signature-based detection to miss obvious patterns. MIXEDKEY handles key derivation and payload decryption.
BINDCLOAK implements the most notable evasion in this campaign: environmental keying via the host volume serial number. Before executing, BINDCLOAK reads the drive serial number and uses it as part of the decryption key. A sample captured from a victim machine will not decrypt or execute correctly on a sandbox with a different drive serial, defeating many automated dynamic analysis pipelines.
Delivery: ISO files and ASUS binary sideloading
The initial delivery mechanism relies on ISO container files, a technique that became widespread following Microsoft's 2022 decision to block macros from internet-sourced Office documents. ISO files bypass Mark-of-the-Web propagation on Windows, meaning files extracted from a mounted ISO do not carry the warning flag that would trigger protected view or SmartScreen prompts.
Inside the ISO, the actor includes a legitimate ASUS-signed binary (GoProAlertService.exe, renamed from its original purpose) alongside a malicious DLL named AsTaskSched.dll. When the victim runs the ASUS binary, it loads the adjacent DLL through a standard Windows DLL search order hijacking path. This sideloading technique lets the actor execute unsigned malicious code under the cover of a signed, trusted parent process.
Why Telegram for C2?
Routing C2 through the Telegram Bot API offers the actor three practical advantages. First, the traffic destination is api.telegram.org, a hostname that most corporate proxies and firewalls allow outright or do not inspect with full TLS interception. Second, there is no attacker-controlled infrastructure to block or sinkhole: the actor's bots live on Telegram's own servers, which cannot be taken offline through standard law-enforcement mechanisms quickly enough to disrupt an active campaign. Third, Telegram's API supports long-polling, meaning the implant can sleep and check in periodically without maintaining a persistent TCP connection visible in netflow data.
The defensive implication is that blocking Telegram at the perimeter will prevent TELESHIM C2, but this is a meaningful policy tradeoff in organizations where employees use Telegram legitimately. A better control is monitoring for Telegram API calls from non-user processes: system services, scheduled tasks, or processes running from unusual paths.
What defenders should prioritize
ISO auto-mount behavior is the first gap to close. Windows 11 disabled ISO auto-run in 2022, but Windows 10 systems and older GPO configurations may still mount ISOs automatically. Verify that ISO auto-mounting is disabled or that files extracted from mounted ISOs are scanned before execution. DLL sideloading via modified ASUS or other vendor binaries should trigger process-creation alerts when a signed vendor binary spawns unexpected children or loads DLLs from non-standard paths. BINDCLOAK's environment keying means sandbox detonation may produce false negatives: treat inconclusive sandbox results on ISO-delivered samples as insufficient grounds for clearance.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to discuss cross-platform C2 abuse or attribution of East Asia threat actors.